Cookie Policy

Effective November 8, 2026

This policy explains the cookies and similar storage that Cairn Labs, Inc. ("Cairn") uses on getoncairn.com and in the Cairn application. We use the minimum needed to sign you in, keep you safe and remember your display preference. We do not use advertising cookies or third-party analytics.

1. What cookies are

A cookie is a small text file a website stores in your browser. Local storage is a similar mechanism that stays in your browser without being sent to the server on every request. Both let a site remember you between pages and visits.

2. The cookies we set

Name	Purpose	Type	Duration
`cairn.session_token` (or `__Secure-cairn.session_token`)	Keeps you signed in. Database-backed and revocable from Settings → Security.	Strictly necessary	14 days, refreshed daily while active
`cairn.session_data`	Short-lived cache of your session to reduce database reads.	Strictly necessary	5 minutes
`cairn.two_factor`	Carries the state of a two-factor sign-in between steps.	Strictly necessary	Until the sign-in completes, at most 10 minutes
`cairn.trust_device`	Remembers a device you marked as trusted so two-factor is not asked every time.	Strictly necessary, set only at your request	30 days
`cairn.state`, `cairn.pkce_code_verifier`	Protect social sign-in against cross-site request forgery.	Strictly necessary	Until the sign-in completes, at most 10 minutes
`better-auth.last_used_login_method`	Remembers which sign-in method you used last so we can highlight it.	Functional	30 days
`cairn.dont_remember`	Set when you choose not to stay signed in, so the session ends with the browser.	Strictly necessary	Browser session

All cookies are first-party, marked HttpOnly where the browser does not need to read them, Secure in production and SameSite=Lax.

3. Local storage

Key	Purpose	Duration
`cairn.theme`	Your light or dark theme choice	Until you clear it
`cairn.next`	The page to return to after a two-factor step, cleared on completion	Session
`cairn.onboarding.draft`	Unsaved onboarding answers, so a refresh does not lose them	Until onboarding completes

Local storage never leaves your browser.

4. Third-party cookies

We do not set third-party cookies on getoncairn.com. If you sign in with Google, GitHub, LinkedIn or Microsoft, that provider sets cookies on its own domain under its own policy during the sign-in redirect. If you link Telegram, Telegram's own policy applies to the Telegram app.

Our payment processor sets cookies on its checkout pages under its own policy when you pay for a plan.

5. Analytics and advertising

We do not use Google Analytics or any third-party analytics or advertising script. Product usage inside the application is measured with first-party server logs tied to your account, which you can read about in the Privacy Policy. We honour the Global Privacy Control signal, although there is nothing to opt out of because we do not sell or share data.

6. Managing cookies

You can delete cookies and local storage in your browser settings at any time. Deleting the session cookie signs you out. Blocking strictly necessary cookies prevents sign-in. The theme preference can also be changed from the toggle in the product header.

7. Changes

We update this policy when the cookies we set change. The effective date at the top reflects the current version.

8. Contact

privacy@getoncairn.com · Cairn Labs, Inc., 1209 Orange Street, Wilmington, DE 19801, United States.